Microsoft’s July 14, 2026 security patch bundles a fix for CVE-2026-33842, an information‑disclosure bug in Windows File Explorer that could let an attacker who’s already logged on to your PC snoop on sensitive data—without needing a single click from you or anyone else. The flaw was rated Important and affects every supported version of Windows client and server, rolling out inside the standard cumulative update.

What the July Update Fixes

CVE-2026-33842 is what Microsoft calls an “exposure of sensitive information to an unauthorized actor” inside File Explorer. The technical CVSS 3.1 vector—AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N—paints a precise picture: exploitation happens locally, requires only low‑level user rights, carries almost no attack complexity, and demands zero user interaction. An attacker who can run code on a machine, even under a standard non‑administrator account, can trigger the leak. The confidentiality impact is high, but the bug doesn’t let the attacker change data, gain higher privileges, or crash the system.

Microsoft hasn’t spelled out exactly what information a successful exploit could harvest, nor which particular Explorer operation or programming mistake is to blame. The advisory classifies the weakness under CWE‑200, a broad umbrella for information exposure. Despite that lack of detail, the severity pattern matters: a vulnerability that works without a victim opening a file, mounting a share, or clicking a malicious shortcut lowers the bar considerably once an intruder has a foothold.

The fix ships exclusively through the July 2026 Windows cumulative update for each supported edition. There is no separate File Explorer package, and Microsoft has not supplied any manual workaround. The corrected build numbers span the entire client and server landscape:

  • Windows 10 version 1607: build 14393.9339
  • Windows 10 version 1809: build 17763.9020
  • Windows 10 version 21H2: build 19044.7548
  • Windows 10 version 22H2: build 19045.7548 (ESU package KB5099539)
  • Windows 11 version 23H2: build 22631.7376
  • Windows 11 version 24H2: build 26100.8875
  • Windows 11 version 25H2: build 26200.8875
  • Windows 11 version 26H1: build 28000.2269

Server editions from Windows Server 2016 through Windows Server 2025 are likewise covered, along with older server branches that are still under security servicing. The broad reach means patch‑management reports should verify the resulting OS build, not just that a “July update” was approved.

Who Is Affected and What Versions Are Patched

Every supported Windows client and server released in the past decade is affected. The list Microsoft published includes Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; and the corresponding Windows Server releases. Windows 10 22H2 systems that are enrolled in Extended Security Updates get the fix via KB5099539, which advances the OS to build 19045.7548. Devices that exited support in October 2025 and aren’t covered by ESU won’t receive this security protection.

Unusually, CVE-2026-33842 arrived as one of eight different File Explorer information‑disclosure vulnerabilities that Microsoft fixed on the same day. The Zero Day Initiative’s Patch Tuesday roundup identified the others as CVE‑2026‑40422, CVE‑2026‑41087, CVE‑2026‑50473, CVE‑2026‑50442, CVE‑2026‑50389, CVE‑2026‑50456, and CVE‑2026‑57084. All carry the same 5.5 CVSS score and Important severity classification, but Microsoft hasn’t confirmed whether they share the same root cause or were discovered through a coordinated code review. The cluster underscores that File Explorer’s information‑handling code, which saturates every Windows installation, has been a ripe target for vulnerability researchers.

Practical Risk for Home Users vs. Enterprise

For a home PC that only you use, CVE‑2026‑33842 is a low‑urgency but not negligible concern. The attack vector is local, meaning someone—or a piece of malware—already needs access to your machine. The vulnerability doesn’t grant remote access by itself, so the risk hinges on whether you share your device or whether malware that has slipped past other defenses could exploit it to vacuum up files, passwords, or session tokens it shouldn’t normally see.

Enterprise environments should look more closely. Any Windows system that hosts multiple users with different trust levels deserves priority: Remote Desktop Session Hosts, virtual desktop pools, shared lab computers, administrative jump servers, or developer workstations where sensitive code and credentials sit alongside lower‑privileged guest or contractor accounts. On those machines, an authenticated attacker with low rights could potentially read data from other users or processes, glean configuration details, or gather intelligence for a lateral‑movement attack. Microsoft didn’t mark this CVE as publicly disclosed or actively exploited as of release day, but the widespread availability of affected builds means patch‑gaps on shared systems create an unnecessary window.

Security teams should also consider CVE‑2026‑33842 in tandem with privilege‑escalation bugs that might get patched in the same or a future update. An information leak by itself may seem modest, yet when paired with another flaw that elevates rights, it can become a critical ingredient in a full compromise chain.

Why This Patch Matters in a Record‑Breaking Patch Tuesday

The July 14, 2026 Patch Tuesday was exceptionally heavy. BleepingComputer tallied 570 vulnerabilities from Microsoft alone, 102 of them classified as information‑disclosure issues. The Zero Day Initiative’s broader accounting included hundreds of additional CVE records and non‑Microsoft product updates. While the raw number can be misleading—it often includes previously released browser fixes and other edge‑case entries—the volume still reflects an unusually large triage burden for IT teams. CVE‑2026‑33842 is therefore just one data point in a massive release, but its presence across every supported Windows edition turns it into a fleet‑wide compliance check rather than a niche patch.

History shows that File Explorer bugs that don’t require user interaction rarely stay theoretical in the long run. Once the patch binary is reversed and the code diff becomes public, proof‑of‑concept code often follows. That hasn’t happened yet—Microsoft and Trend Micro’s ZDI both confirm no known exploitation—but the clock starts ticking with every Patch Tuesday.

Your Action Plan: How to Get Protected

1. Install the July cumulative update now.
For most users, Windows Update in Settings will offer the package automatically. If you manage updates through WSUS, Configuration Manager, Intune, or a third‑party tool, approve the latest cumulative update for your Windows client and server editions. The fix is integrated; you don’t need to look for a separate File Explorer patch.

2. Verify the build number after updating.
Check that your device reaches the build numbers listed earlier. A quick way is to run winver from the Run dialog. If the build is lower than expected, investigate whether a servicing stack update or a pending reboot is blocking installation.

3. Prioritise shared and high‑exposure systems.
If your organisation uses multi‑user workstations, virtual desktop infrastructure, or remote‑access hosts, move those machines to the front of the deployment queue. On single‑user laptops and desktops, you can follow your normal patch cycle.

4. Don’t attempt to mitigate with Explorer policies or registry tweaks.
Microsoft hasn’t disclosed a specific trigger that can be safely disabled. Unsanctioned workarounds risk breaking shell functionality without guaranteeing protection.

5. Watch for reboot requirements.
Cumulative updates almost always require a restart. Plan maintenance windows or notify users to save work.

What Comes Next

At this point, the story is straightforward: apply the patch, confirm the new build, and move on. But because Microsoft has not shared technical root‑cause details, the full scope of the vulnerability may only become clear when researchers or the original reporter publish a deeper analysis—or when exploit code surfaces. For now, the safe bet is to treat CVE‑2026‑33842 as a high‑priority patch on any machine where multiple users log on, and as standard maintenance everywhere else.